When Balancing Harms: Structural Conditions That Degrade Android Malware Detection After Class Imbalance Correction - Oliveira, Lucas Ferreira Areias de; Silva, Anna Luiza Gomes da; Diniz, Angelo; Kreutz, Diego; Schmidt, Dionatan R.; Mansilha, Rodrigo; Paim, Kayuã Oleques (Anais do Simpósio Brasileiro de Cibersegurança (SBSeg), 2026)
Class imbalance is a recurrent challenge in Android malware detection, and class balancing is often adopted to improve minority-class detection. This paper compares original, dimensionality-reduced, and class-balanced versions of 11 Android malware datasets, using Recall, F1-score, and execution time. Dimensionality reduction followed by class balancing improved performance in 7 of the 11 datasets; in MH100k, this combination increased Recall from 0.63 to 0.99 and reduced execution time by approximately 99%. However, class balancing reduced performance in 4 datasets, especially in cases characterized by high sparsity, reduced diversity, or near-balanced class distributions, indicating that it should be empirically validated rather than applied by default.